CyberRota Analysis
AI-GeneratedAVideo's Live_schedule::setTitle() and setDescription() functions are vulnerable due to inadequate sanitization of POST input, enabling users with streaming permissions to inject malicious scripts. This flaw allows unauthenticated attackers to exploit the remindMe.php endpoint, executing stored XSS payloads in the browsers of affected users. Organizations utilizing AVideo should prioritize addressing this vulnerability to mitigate potential exploitation and protect their users from cross-site scripting attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.